reCAPTCHA website security and fraud protection

reCAPTCHA leverages a sophisticated and adaptable risk analysis engine to shield against automated software, thwarting abusive activities within an organization’s website and mobile apps.

Safeguards your website and mobile applications from abusive traffic without compromising the user experience. reCAPTCHA employs an invisible score-based detection mechanism to differentiate between legitimate users and bots or other malicious attacks.

Utilizing Google-scale fraud intelligence, reCAPTCHA’s adaptable risk analysis engine assigns a risk score to each phone number, helping organizations to identify those at risk of involvement in SMS toll fraud attacks. This enables organizations to take proactive measures by blocking suspicious SMS messages before they are sent, resulting in significant cost savings.

Provides a transaction risk score that helps identify and block fraudulent transactions. By merging Google-scale fraud intelligence with our expertise in payment risk and modeling, reCAPTCHA helps secure payment workflows at scale.

Protects your organization from fraud and abuse when dealing with traffic coming from any endpoint. In addition to website security, reCAPTCHA provides native mobile SDKs for iOS and Android. For endpoints that cannot run web JavaScript or mobile SDKs, reCAPTCHA Express can support clients like smart devices and IoT devices.

Providing global insights against fraud using threat intelligence telemetry from trillions of transactions, billions of users and devices, and millions of websites, reCAPTCHA provides global insights against fraud. These insights power our detection models to help protect from fraudulent activity, spam, and abuse.

Offers comprehensive protection for the entire customer journey, including user-generated content, registration, login, cart, and payment transactions. This integration across various user and payment flows leverages optimized AI/ML models to enhance security.

Uses a powerful combination of artificial intelligence (AI), machine learning (ML), clustering, and neural networks to uncover the most sophisticated threats. Our AI/ML-driven threat detection is capable of identifying active attacks and uncovering the connections between adversaries and their operations.

Multi-factor authentication (MFA) with reCAPTCHA offers an enhanced level of security by introducing an additional authentication step for logins and other user flows. This approach helps organizations combat credential stuffing attacks and protect against account takeovers.

Securely compares passwords against Google's database of over four billion leaked credentials from third-party breaches. If a match is found, you can take actions like warning the user, requiring a password change, and optionally triggering MFA. This helps mitigate account takeover risks from credential stuffing attacks, protecting both user privacy and your site's reputation.

Helps you detect groups of accounts exhibiting suspicious or related behavior. This information enables you to take proactive measures like disabling related accounts, restricting their actions, or implementing additional verification processes to mitigate the impact of malicious actors.

Integrates with your existing WAF (web application firewall) to provide enhanced detection and protection at the network edge. This integration works with WAF providers like Google Cloud Armor, Fastly, and Cloudflare. By deploying reCAPTCHA as a service at the WAF layer, you can detect and block abusive traffic before it even reaches your web application's infrastructure.

Google Cloud's web app and API protection (WAAP) solution combines reCAPTCHA Enterprise, Cloud Armor, and Apigee for powerful protection. reCAPTCHA Enterprise offers advanced bot detection and fraud protection, Cloud Armor acts as a web application firewall (WAF) to block attacks, and Apigee secures your APIs through management and analytics. Together, they provide a multi-layered defense against various web threats.

Analyzes a vast array of signals, including user behavior, device information, IP addresses, and historical interaction patterns to assess the risk level associated with a particular action on your site or mobile app. Organizations can fine-tune the risk analysis engine to your site’s specific needs.

Offers a dashboard with insights and analytics to help you proactively manage bot and fraud risks. The dashboard provides visibility into key metrics like overall risk scores, attack trends, challenge success rates, and the effectiveness of your risk thresholds. It also includes tools for visualizing data over time, and drilling down into suspicious activity patterns.

Within the cloud-based console, you can identify traffic anomalies and leverage platform logs for further investigation. To gain insights into a specific incident, users can click a link that leads to a pre-filtered sample of all logs associated with that particular anomalous event.

reCAPTCHA secures data with client-side storage, anonymization, and privacy technologies. Data gathered is used only for reCAPTCHA's operation and security, not for personalized advertising by Google. See reCAPTCHA Terms of Service for more information.

Use reCAPTCHA Essentials for a simple, free solution to safeguard your website against spam and abuse.

Discover how reCAPTCHA boosts your website's security with a personalized interactive demo.

Webinar: Shielding Your Business from Account-Based Fraud with reCAPTCHA

Webinar: Protect your business from account takeovers with reCAPTCHA

Webinar: Protecting Your Users from Password Leaks with reCAPTCHA

Frictionless experience

Unlocking millions of dollars in additional funds with a frictionless experience.

Fraud intelligence

Incorporating Google-scale fraud intelligence signals in reCAPTCHA to inform internal ML models.

Transaction protection

Targeting fraudulent payments and mitigate them in real time, while allowing good payments to go through.

How do I access the legacy reCAPTCHA Classic Admin Console?

The Classic Admin Console (formerly on google.com/recaptcha) is now accessible here, and via the "Legacy Admin Console" link in the left navigation. You can also continue to access the console using the same URL; there's no need to update existing bookmarks. All the same functionality is available, and your existing login credentials will still work.

What is reCAPTCHA?

reCAPTCHA is a modern modern bot protection and fraud prevention platform that protects your website and mobile apps against bots, account takeovers, and fraudulent transactions. Powered by Google-scale fraud intelligence telemetry from trillions of transactions, billions of users and devices, and millions of websites, reCAPTCHA provides global insights against cyber fraud to protect any endpoint across the entire customer journey. And with custom AI models, we ensure organizations can protect against sophisticated cyber threats with zero end user friction.

How do I use reCAPTCHA?

To get started with reCAPTCHA, create a free account. Subsequently, integrate a few lines of code into your website. Afterward, connect reCAPTCHA to your backend and design assessments. When users engage in actions like user verification or payment processes, reCAPTCHA will assess the user interaction and provide a score. Based on this score, you can determine appropriate actions for your website.

Is reCAPTCHA only visual challenges?

reCAPTCHA provides multiple methods to verify that a user is human, including invisible verification, risk-based scoring, and visual challenges. Since 2020, reCAPTCHA primarily works in the background, continuously analyzing user behavior and assigning a risk score. Organizations can then take actions based on the risk score.

Can I integrate reCAPTCHA with my other fraud tools?

Yes, you can integrate reCAPTCHA with various other fraud prevention tools. reCAPTCHA is designed to work alongside existing fraud protection solutions, and by adding reCAPTCHA to your website or mobile app, you gain an additional layer of security that is powered by Google-scale fraud intelligence.

Is reCAPTCHA available for mobile?

Yes, reCAPTCHA is available for mobile apps through our easy-to-integrate SDKs. The reCAPTCHA mobile SDKs enable you to protect your iOS and Android apps from fraudulent activity, spam, and abuse. By adding a few lines of code, you can use reCAPTCHA to verify user responses and prevent automated tools from accessing your app.

What types of online fraud does reCAPTCHA protect against?

reCAPTCHA protects against bots, website scraping, account takeovers, fake accounts, credential stuffing, payment fraud, card testing, chargebacks, stolen instruments, and gift card testing.